Access-Control-Allow-Origin Issue - php

I have the following in my .htaccess located in http://cdn.example.com
Header add Access-Control-Allow-Origin "http://example.com"
When I go to my site it works fine and allows me to grab from my CDN.
BUT A user of my site just pointed out to me that when you go to www.example.com (www. before site name) it wont load font files. I tried adding another header add but it then says theres 2 values and it just goes for only one of them (example.com)
I have no idea how to fix this I generally want a way to fix this from htaccess and not from a php file.

Related

Blocked a frame with origin from accessing a cross-origin frame in wordpress

I am working on a website, let say the website name is "https://website" (which is built on wordpress) in which I am getting the following error on console:
Uncaught DOMException: Blocked a frame with origin "https://website" from accessing a cross-origin frame.
at contents (https://website/wp-admin/load-scripts.php?c=1&load%5B%5D=jquery-core,jquery-migrate,jquery-ui-core,jquery-ui-widget,jquery-ui-mouse,jquery-ui-sortable,utils,underscore,wp-util,backbone,&load%5B%5D=moxiejs,plupload&ver=4.9.8:2:26921)
at Function.map (https://website/wp-admin/load-scripts.php?c=1&load%5B%5D=jquery-core,jquery-migrate,jquery-ui-core,jquery-ui-widget,jquery-ui-mouse,jquery-ui-sortable,utils,underscore,wp-util,backbone,&load%5B%5D=moxiejs,plupload&ver=4.9.8:2:3613)
at a.fn.init.n.fn.(anonymous function) [as contents] (https://website/wp-admin/load-scripts.php?c=1&load%5B%5D=jquery-core,jquery-migrate,jquery-ui-core,jquery-ui-widget,jquery-ui-mouse,jquery-ui-sortable,utils,underscore,wp-util,backbone,&load%5B%5D=moxiejs,plupload&ver=4.9.8:2:27001)
at b (https://website/wp-admin/load-scripts.php?c=1&load%5B%5D=postbox,thickbox,hoverIntent,common,admin-bar,wp-a11y,updates,plugin-install,svg-painter,heartbeat,wp-auth-check,shortcode,wp-ba&load%5B%5D=ckbone,media-models,wp-plupload,wp-mediaelement,wp-api-request,media-views,media-editor,media-audiovideo,mce-view,imgareaselect,&load%5B%5D=image-edit&ver=4.9.8:347:103)
at HTMLBodyElement.<anonymous> (https://website/wp-admin/load-scripts.php?c=1&load%5B%5D=postbox,thickbox,hoverIntent,common,admin-bar,wp-a11y,updates,plugin-install,svg-painter,heartbeat,wp-auth-check,shortcode,wp-ba&load%5B%5D=ckbone,media-models,wp-plupload,wp-mediaelement,wp-api-request,media-views,media-editor,media-audiovideo,mce-view,imgareaselect,&load%5B%5D=image-edit&ver=4.9.8:347:1306)
at HTMLBodyElement.dispatch (https://website/wp-admin/load-scripts.php?c=1&load%5B%5D=jquery-core,jquery-migrate,jquery-ui-core,jquery-ui-widget,jquery-ui-mouse,jquery-ui-sortable,utils,underscore,wp-util,backbone,&load%5B%5D=moxiejs,plupload&ver=4.9.8:3:12444)
at HTMLBodyElement.r.handle (https://website/wp-admin/load-scripts.php?c=1&load%5B%5D=jquery-core,jquery-migrate,jquery-ui-core,jquery-ui-widget,jquery-ui-mouse,jquery-ui-sortable,utils,underscore,wp-util,backbone,&load%5B%5D=moxiejs,plupload&ver=4.9.8:3:9173)
at Object.trigger (https://website/wp-admin/load-scripts.php?c=1&load%5B%5D=jquery-core,jquery-migrate,jquery-ui-core,jquery-ui-widget,jquery-ui-mouse,jquery-ui-sortable,utils,underscore,wp-util,backbone,&load%5B%5D=moxiejs,plupload&ver=4.9.8:3:11573)
at Object.a.event.trigger (https://website/wp-admin/load-scripts.php?c=1&load%5B%5D=jquery-core,jquery-migrate,jquery-ui-core,jquery-ui-widget,jquery-ui-mouse,jquery-ui-sortable,utils,underscore,wp-util,backbone,&load%5B%5D=moxiejs,plupload&ver=4.9.8:9:8275)
at HTMLDivElement.<anonymous> (https://website/wp-admin/load-scripts.php?c=1&load%5B%5D=jquery-core,jquery-migrate,jquery-ui-core,jquery-ui-widget,jquery-ui-mouse,jquery-ui-sortable,utils,underscore,wp-util,backbone,&load%5B%5D=moxiejs,plupload&ver=4.9.8:3:18991)
The above error is generated by clicking View Details section of wordpress plugins (as shown below):
This error seems to exist in every single wordpress plugins but it works when I open in a new tab but it doesn't work when I open in the same window.
Problem Statement:
I am wondering which file I need to modify in wordpress in order to solve this error. This error seems to exist in every wordpress plugins. As mentioned, it works in a new tab but fails to work in the same page.
I have a feeling I have to make some changes in the following file by seeing the error above (load-scripts.php, as the error is generated in that file) but not sure what line I need to add in order to make it work.
https://website/wp-admin/load-scripts.php

Something bad has happend to your WordPress admin interface.
The first thing to notice is that the error you have described is a well known problem as you may have already noticed: SecurityError: Blocked a frame with origin from accessing a cross-origin frame
Look at the first answer there:
You can't access an with different origin using JavaScript,
it would be a huge security flaw if you could do it. For the
same-origin policy browsers block scripts trying to access a frame
with a different origin.
Protocol, hostname and port must be the same of your domain, if you
want to access a frame.
The second thing to notice is what the "View details" button in the WordPress admin interface does: It opens a ThickBox containing and iframe which is showing remote contents quite often within an IFrame. How this works is ecactly described here: https://codex.wordpress.org/Javascript_Reference/ThickBox
load-scripts.php is an important WordPress core file loaded in the admin which is used to load JavaScript files without having to embed each of them. Those JavaScript files are usually added to your WordPress admin with the admin_enqueue_scripts() function (https://codex.wordpress.org/Plugin_API/Action_Reference/admin_enqueue_scripts).
As your problem is quite uncommon and the "View details" button for Plugins works almost everytime there are only two possibilities:
1. The "View Details" IFrame is usually loaded from the same location where your WordPress is - therefore you might have a problem such that the browser wants to load it from a different host
This happens if you have some misconfiguration within your WordPress installation and Thickbox tries to get an IFrame from a host which the Browser thinks is another host. Configure WordPress correctly.
2. You have a badly programmed plugin or theme which is injecting a script causing this problem
Solution: Deactivate your theme and all your plugins one-by-one and see if the error still exists. This way you can find out the modification which causes the problem and maybe do a bug request to the plugin developers then.
It is almost 100% sure that a single plugin, theme or misconfiguration is causing this problem.

For posterity, chances are your X-Frame-Options have either been set to deny by the server or a configuration was appended by another plugin, but the blocked frame issue may happen when your server has not been configured correctly or was configured with strict policies to prevent any sort of access to cross-origin frames. Since every plugin is affected when viewing the Details link, my answer coincides with what #Blackbam has explained regarding how it functions by bringing up a thickbox and uses an i-frame when explaining why they all don't seem to appear.
I am wondering which file I need to modify in WordPress in order to
solve this error. This error seems to exist in every wordpress
plugins. As mentioned, it works in a new tab but fails to work in the
same page.
So, for this particular case I don't believe it's necessarily a WordPress issue but a hosting server configuration and, depending on how much access you have to the server or wherever you're building the website, will determine what you can do to solve this error or whether or not you'll need to contact support to help you resolve it.
(Since this answer is simply added for posterity, please excuse the present tense references used as I realize it's been 3 years since this was asked)
Solutions:
There are two options that may work for you, and will vary depending on your server and your user access.
Solution 1: Adding permissions by modifying the .htaccess file
If your webhosting server is running on Apache or other supported web server, you can try adding the lines below to the .htaccess file:
<ifModule mod_headers.c>
Header set Strict-Transport-Security "max-age=31536000" env=HTTPS
Header always set X-Frame-Options "sameorigin"
Header setifempty Referrer-Policy: same-origin
</ifModule>
For syntax, you can refer to to this page. But as another option, instead of setting X-Frame-Options to "sameorigin" you can also specify a particular domain so as to preserve the security feature if preferred, such as:
Header always append X-Frame-Options "ALLOW-FROM website.com/*"
And replacing "website.com/*" with the domain you would like to permit, noting the space between ALLOW-FROM and the URL as further explained here. If you have other plugins installed that have modified your .htaccess file, be sure to place this entry above any Wordpress created entry as the .htaccess file is loaded in order and also note that it may not be supported in all browsers. Now, depending on the server security policies, if this doesn't work, then you'll have to move on to the next solution.
Solution 2: Modify your server configuration
Though I'm only including instructions for an Apache server from here as reference, this page includes configurations for Nginx, IIS, HAProxy, and Express as well. A full explanation can be found here if you have access to WHM and/or are running virtual servers and will require root access.
Log into the web server and look for the following file:
/etc/apache2/conf/httpd.conf
# or you can also create a new file named 'include.conf' if it
# doesn't already exist
/etc/apache2/conf.d/userdata/{USERNAME}/{DOMAIN-NAME}/include.conf
If the file exists, you can either comment out the line if it's set to DENY to disable the restriction or add the line below to the newly created configuration file:
<ifModule mod_headers.c>
Header set Strict-Transport-Security "max-age=31536000" env=HTTPS
Header always set X-Frame-Options "sameorigin"
</ifModule>
You'll then need to rebuild the configuration and restart the Apache server.
You can rebuild by running the command
/usr/local/cpanel/scripts/rebuildhttpdconf
Then restart with
/usr/local/cpanel/scripts/restartsrv_httpd
Without the same-origin setting, even though Wordpress is installed on the server, the jquery requests are being blocked as part of preventing any embedding of content from other sites as well. Read more about Secure Headers from OWASP

Wordpress homepage 301 redirect to localhost

I've just moved a WordPress website from my local machine to the server. All the normal steps were done, such as updating the SQL database and setting it all up. The only problem is the homepage is 301 redirecting to my local URL even though it has the correct URL to go to. The rest of the website is fine including the admin area. So far I've done the following:
Checked the SQL database to look for any localhost URL's
Defined the wp_home and wp_siteurl in the wp-config file
Also defined it in the functions file
Disabled caching
Flushed the permalinks
Disabled plugins
Checked for hardcoded URL's in the PHP
Deleted the .htaccess file and created a brand new one
Any further ideas please?

The solution to the problem was just browser caching, just needed to load it in a different browser which was cache free

Change Startup Page of a WordPress website

I have an installed WordPress website.
I'm working on the site, therefore, I want to show a constructor page for the internet user. I have created a page which called first.html and I change the .htaccess file like below
#Alternate default index page
DirectoryIndex first.html
Now when I enter my domain name on the browser I can see the first.html. This is working properly.
I'd like to see my changes by entering the domain and page name on the browser like
www.mydomain/index.php
or
www.mydomain/wp-content/themes/XXXTHEME/index.php
However, my theme pages don't work.
How can I achieve to do this?

Instead of making changes in .htaccess, I'd suggest you to use this plugin : https://wordpress.org/plugins/maintenance/

Simply name your html file "index.html"
Web servers most commonly parse the index.html file firstly (unless told otherwise) and if it is not found, it proceeds to index.php
This also allows you to simply change that ".html" part to ".php" to see the website you are working on, without installing plugins that clutter your database or making unnecessary changes to your .htaccess file.

How to change base url to subdirectory CakePHP?

I have a cakephp 3 script installed on my cpanel account.
this domain is the primary domain for account but i have relocated it to a subfolder for necessary reasons.
my htaccess rewrites it perfectly and every url works both with and without /subfolder/ in the url.
However, all the links in cakephp automatically append /subfolder/ back into the url.
I even tried manually replacing $base_url in configuration.php with 'mydomain.com'; only, but that didn't work. Then I replaced every instance in all the hundreds of files of $base_url with 'mydomain.com'; but still, nothing changed and it still shows that /subfolder/ in every url even when i access mydomain.com directly._
I need to get rid of this /subfolder/ in the url that cakephp is serving from php. i tried everything i knew but nothing works.
Please tell me how to solve this problem.

Have you tried setting App.base, App.webroot? Setting those values up will disable automatic directory detection and should help you get the URLs you want. See configuration docs for more on those values.

Magento site not working after changing location

I have a magento site. When I changed it location, it is not working.
I am getting the errors :
The page isn't redirecting properly in Mozilla.
This webpage has a redirect loop in Chrome.
For changing the location what I have done is:
1) Imported my database and changed the urls in core_config_data table.
2) Changed the db credentials in local.xml
3) Cleared the var folder.
I have found various solutions for the same problem but nothing resolved my issue.
Like clearing the cache, auto increment of ids in database etc.
I am able to access my backend

These are the steps I go through when I find such problems
Delete the cache, full page cache(If it exists) sessions, and log folders from with the var directory
Go into core_config_data
Using a Database tool, search (value "contains" http)
This will show you your site urls referenced from within the database.
Make sure web/unsecure/base_url and web/secure/base_url
both reference your domain without any https: at first
i.e they both should contain http://mydomain.com/
Last as kaigorodov says above check the cookie_path
Next, reference your .htaccess file. Here's an option
via terminal
cd into the root of your install. i.e
cd /public_html/magento
Again verify your .htaccess file.. One option is duplicate your existing file and rename the .htaccess-sample to .htaccess and use this one to be sure this isn't causing your problem.
Could be web server caching. Try restarting that if you have ownership.

Infinite loop problem often related to improper magento cookies configuration. Try to check the cookie_domain and cookie_path settings in the core_config_data table.

It's a www to non-www redirect. Because I don't have the install in front of me to help I can't narrow down the cause, but maybe within your core_config_data you use www on some and non www on others. Maybe your .htaccess has a www redirect in place?
Maybe Catalog > URL Rewrite Management turning the www to non redirect off may fix your problem

Categories